Not much actually, you can alreay send and receive messages and group messages using the daemon and D-Bus.

A few methods are left to add in this interface and in this class. I conctacted AsamK who’s okay with his project being used as a base for the Librem 5 Signal client. Moxie is aware of signal-cli and seems not to have done anything to stop it.

The whole shipping issue is different though. It is not technically complicated, but Moxie is against a packaging of signal-cli’s dependencies as .deb packages.

I am not a DBus expert, especially regarding security issues.
That said, there are two security elements that seem reasonable to me:

The bus used by the daemon will be session bus, and not system bus

The policy regarding the signals and methods will be deny-by-default and allowed only for the user who needs to access such information. In the context of an integration with the Librem 5, I can’t say yet which user will be used by the Features frontend. See dbus doc, policy section for more information

If you think of anything that would help harden the application, please speak